DPDP Act for Real Estate Leads: What Changes by May 2027

Open your lead sheet. Somewhere in it is a column of names and mobile numbers from the 2024 launch, a few hundred of them never reached. Next to it is a CRM, a WhatsApp tool and perhaps an AI dialer, each holding its own copy. Until now that sheet was a sales asset. From mid May 2027 it is also a legal liability with a statutory schedule of penalties. This post walks the Digital Personal Data Protection Act, 2023 and the Rules of 2025 through the life of one real estate enquiry, using the provisions themselves.

Does the DPDP Act apply to a real estate developer's lead data?

Yes. The Act defines personal data as any data about an individual who is identifiable by or in relation to that data, and a name with a phone number qualifies. A developer that decides why and how enquiry data is processed is a Data Fiduciary. Any vendor that processes it on the developer's behalf, such as a CRM, a WhatsApp provider or an AI calling platform, is a Data Processor.

The part that catches presales teams out is Section 8(1). The Data Fiduciary stays responsible for compliance irrespective of any agreement to the contrary, including for processing done on its behalf by a processor. You cannot outsource the liability by outsourcing the dialling.

When do the DPDP Rules actually apply to presales?

The DPDP Rules, 2025 were published in the Gazette of India on 13 November 2025; the Press Information Bureau dates the notification 14 November. Rule 1 phases them in. Rules 1, 2 and 17 to 21 applied on publication, Rule 4 on Consent Managers applies after one year, and Rules 3 and 5 to 16 apply eighteen months after publication. Eighteen months from November 2025 is mid May 2027, roughly seven months from today.

The rules that matter to a presales desk are all in the eighteen month group: the consent notice (Rule 3), security safeguards (Rule 6), breach intimation (Rule 7), erasure and log retention (Rule 8), published contact details (Rule 9) and the grievance and rights process (Rule 14). The Act's own commencement is by government notification under Section 1(2), so check the current notification status before you plan around a date.

Is a portal enquiry consent, or a legitimate use?

Neither label fits cleanly, and the Act's own example is the best guide. Section 7(a) allows processing for the specified purpose for which the person voluntarily provided their data, as long as they have not indicated that they do not consent to that use. One of the Act's illustrations under it involves a real estate broker: a person messages a broker asking for help finding a rental and shares their data; the broker may process it to identify and send details of available accommodation; when the person later says they no longer need help, the broker must stop.

Read that for a developer. A buyer who submits an enquiry for a 3 BHK in Tower B has given you data for a specified purpose: to tell them about that unit. Calling to answer the enquiry sits comfortably inside it. Stopping when they say stop is mandatory. What the illustration does not do is stretch that purpose to every project you launch next year.

Take a representative Jaipur developer, illustrative and not a client: a 1,400 row sheet from a 2024 launch, with 600 numbers that never connected. A reactivation call about the same project is an extension of the original purpose. A broadcast about a different township in another part of the city is a different purpose, and the Act's text does not tell you whether the old enquiry covers it. We are not offering legal advice; the conservative design is to reconfirm permission on the first call and record the answer.

What must a consent notice on a lead form contain?

Under Rule 3, the notice must be understandable independently of any other information, written in clear and plain language, and give at minimum an itemised description of the personal data and the specified purposes. It must also give a link and a description of other means by which the person can withdraw consent, exercise their rights and complain to the Board, with withdrawal as easy as giving consent.

Section 6(3) adds two practical points for an Indian audience: the request must be available in English or any language in the Eighth Schedule to the Constitution, and must give the contact details of a Data Protection Officer or another person who can answer the person's questions. Hindi, Marathi, Gujarati and the rest are therefore a legal option for the buyer, not just a conversion tactic. A workable checklist for the form footer:

• Name the data: name, mobile number, email, budget band, preferred configuration.
• Name the purposes: to answer this enquiry by phone, WhatsApp and email, and to arrange a site visit for this project.
• Say how to stop: one reply word on WhatsApp, one line on the call, one link on the form.
• Give a human contact for questions, as Rule 9 expects, on the site and in every reply to a rights request.
• Offer the notice in the buyer's language, and keep a record of the version shown and the time it was accepted.

How does an AI calling vendor change your DPDP obligations?

It adds a processor to the chain and changes nothing about who is liable. Section 8(2) says a Data Fiduciary may use a Data Processor only under a valid contract, and Rule 6(1)(f) expects that contract to carry appropriate security safeguards. When a person withdraws consent, Section 6(6) obliges you to cease processing and to cause your processors to cease too, and Section 8(7)(b) extends the erasure duty to them.

That makes the vendor contract and the product behaviour two halves of one control. A written promise to honour opt outs is worth little if the agent cannot take a spoken "please don't call again" and write it back to the CRM within the same hour. These are the questions to put to any vendor, including us:

What about call recordings and the one year log rule?

The text pulls two ways, and a developer should know it before choosing a retention period. Rule 6(1)(e) and Rule 8(3) require personal data and logs of processing to be kept for at least one year, with the Rules' own illustrations covering data held by a processor such as a cloud provider. Section 8(7) and the withdrawal provisions require erasure once the purpose is served or consent is withdrawn, unless retention is needed by law.

The Rules do not spell out, for a developer, how a withdrawn consent interacts with the one year minimum. Until guidance or counsel settles it, design so the recording is separable from the lead record: the lead can be erased from sales systems on withdrawal, while the log is held in restricted storage for its minimum period and then deleted.

What should a developer do before May 2027?

Six things, most of them cheaper to do now than in the quarter before the deadline, and none of them needs new software.

1. Map where lead data lives

List every place an enquiry goes: portal exports, partner sheets, the CRM, WhatsApp, the dialer, the vendor's recording store, someone's personal spreadsheet. You cannot erase or protect data you cannot locate.

2. Rewrite the notice on every form

Use the Rule 3 checklist above on the website form, the landing pages and the partner registration link. Keep the old version on file so you can show which text a given buyer saw.

3. Triage the old database

Split it by project and by date. Enquiries for live inventory sit inside their original purpose. Leads for sold out or finished projects are the candidates for erasure under Section 8(7). Do this before the next reactivation campaign, not after it.

4. Re-paper the vendors

Put the five questions in the table to each processor and get the answers into the contract. Pay attention to who erases what, and when.

5. Write the breach runbook

Rule 7 requires intimation to each affected person without delay and to the Board without delay, with updated detail within seventy two hours of becoming aware. Decide in advance who owns that clock, who drafts the message, and how you reach buyers who only ever gave a phone number.

6. Publish the human contact and the grievance route

Rule 9 and Rule 14 expect a visible contact and a published period, not exceeding ninety days, for responding to grievances. A developer with no process today should assign an owner this month.

Where does IndiaCalling.ai fit, and what does it not do?

The agent makes the process side of this easier to run and to evidence. It calls within seconds of the enquiry, so the call happens inside the purpose the buyer gave you. Every call is recorded and transcribed with its outcome, so a spoken opt out or a consent answer is on record rather than in someone's memory. It writes the result back to your CRM, so a stop request does not depend on a caller remembering to update a sheet.

What it does not do is make you the Data Fiduciary's lawyer. Notice wording, retention periods, the processor contract and the breach runbook remain your decisions, and you should take legal advice on them. Choose any vendor, us included, on whether it can answer the five questions in the table above in writing.

Consistency is the underrated compliance feature. A desk of twelve callers delivers twelve versions of the opening line, and only some of them mention that the buyer can say stop. An agent delivers the same opening every time, which is easy to review and easy to correct.

Compliance and conversion pull in the same direction here. A buyer who sees a plain notice, gets one prompt call and can stop it with a word is a better lead than one who feels chased. If you want the flow reviewed against the checklist, see how the IndiaCalling.ai agent handles calls, consent capture and records, then book a call with your own form and vendor list in hand.

The Act lets you keep calling about the thing the buyer asked about. It does not let you forget that they can say stop.